Contents: [Dobrica Pavlinušić's random unstructured stuff]
• Dobrica Pavlinušić's random unstructured stuff (NS4300N) 
• Dobrica Pavlinušić's random unstructured stuff (hack upgrade) 
• Dobrica Pavlinušić's random unstructured stuff (get root with plugin) 
• Dobrica Pavlinušić's random unstructured stuff (NS4600) 
• Dobrica Pavlinušić's random unstructured stuff (hack upgrade) 
• Dobrica Pavlinušić's random unstructured stuff (serial port) 
• Dobrica Pavlinušić's random unstructured stuff (reset password) 
• Dobrica Pavlinušić's random unstructured stuff (u‑boot info) 
• Dobrica Pavlinušić's random unstructured stuff (u‑boot boot to shell) 
• Dobrica Pavlinušić's random unstructured stuff (manual boot with root shell) 

Similar board with instructions for Debian install: https://github.com/alexeicolin/javelin 
NS4300N
• Porting openwrt to mpc8343‑based NAS
• https://forum.openwrt.org/viewtopic.php?id=47856 
Hold reset button below ethernet connector to reset admin account password to admin.
Operating System        Embedded Linux
Version         01.02.0000.05
CPU     MPC 8343

ssh package: http://www.16paws.com/projects/NS4300N/dropbear.html 
 telnet: http://www.avsforum.com/forum/26‑home‑theater‑computers/859675‑promise‑smartstor‑ns4300n‑8.html#post15558981 
hack upgrade
http://www.avsforum.com/forum/26‑home‑theater‑computers/859675‑promise‑smartstor‑ns4300n‑22.html 
I spent some time digging around my NS4300N and found the symmetric key password for firmware upgrade packages and probably NS4600 plugins. I have verified that this password (used with bcrypt) decrypts and encrypts NSx700, NS4600, NS4300N, NS2300N firmware packages.

The password is "30570000"

it's quite simple to decrypt and unpackage a firmware release, for example (from a linux box):

mv ns4300_010512.upg ns4300_010512.bfe
bcrypt ns4300_010512.bfe
Encryption key: 30570000
dd if=ns4300_010512 of=ns4300_010512.tgz bs=1k skip=79
tar xzf ns4300_010512.tgz

leaves you with rev, fix_script, kernel, rootfs, pro_sqfs, & usr_sqfs files
you can then mount the various fs images on a loopback device and modify to you hearts content, reverse the above steps and use normal upgrade process to flash the modified firmware

have fun!

get root with plugin
http://www.avsforum.com/forum/26‑home‑theater‑computers/859675‑promise‑smartstor‑ns4300n‑7.html#post15191530 
After much pain and suffering today, I got the engmode shell to be a full shell on the SR5 firmware. Here's the steps (assuming you are on Mac Os X or Linux):

1) Download the new itunes plugin frimware from promise--

itunes_plugin_0000_010002_A1.ppg

2) Extract the tarball:

dd if=itunes_plugin_0000_010002_A1.ppg of=test.tgz bs=97k skip=1
tar -zxvf test.tgz

This makes the file "rev" and the directory "itunes" in the current directory.

3) Edit the "itunes/upgrade_script" perl script. Add the following lines at the top after the "#!/usr/bin/perl" line:

system qq(sudo cp /etc/passwd /tmp/passwd);
system qq(sudo sed -e 's/engsh/sh/g' /tmp/passwd > /tmp/passwd.wks);
system qq(sudo cp /tmp/passwd.wks /etc/passwd);

Save the file.

4) Create a new plugin ".ppg" file with your changes:

tar -zcvf itunes.tgz ./rev ./itunes
dd if=/dev/zero of=itunes_plugin_0000_010002_A1_mod.ppg bs=97k count=1
cat itunes.tgz >> itunes_plugin_0000_010002_A1_mod.ppg

5) Put this modified file itunes_plugin_0000_010002_A1_mod.ppg on one of the NS4300N's shares.

6) Uninstall the itunes/firefly plugin (if you had it installed previously)

7) Install the modified itunes plugin

8) After the Installation OK dialoge comes up, test the telnet:

telnet YOUR_BOX_IP_ADDRESS 2380

login=engmode
pwd=hawk201

9) You may have to uninstall this plugin and reinstall the original, I saw some flakey behavior where itunes/firefly didn't want to startup till I reinstalled with the original plugin from promise. Might be I need a "chmod -R 777" or some such in the building of the plugin. But as uninstalling and reinstalling is not so much a pain I didn't take the time to verify.

This may be lost after reboot of the NS4300N (i have a feeling the passwd file is refreshed from /data after a reboot). I just wanted to get this out to everyone in case they wanted to play around.

For those that want to make the firefly config file writeable, keep in mind that the NS4300N's design overwrites the config file when the firefly server is enabled/disabled from the web interface with the original configuration file. I found it simpler to make some soft links than to work around Promise's design paradigms.

NS4600
Operating System        Embedded Linux
Version 02.01.0000.16
CPU     AMCC 431
Network Adapter Gigabit Ethernet Card 10/100/1000 Mbps
MAC Address     00:01:55:30:53:8D

• http://scratchpad.wikia.com/wiki/NS4600 
Latest firmware:
Update 3TB HDD support models ‑ 2011/11/17 02.01.0000.22
hack upgrade
# bcyrypt as above....

dd if=foo of=foo.tbz bs=1k skip=46
mkdir foo-files
tar xvf ../foo.tbz

apt-get install mtd-utils

dpavlin@klin:/tmp/foo-files$ /usr/sbin/jffs2dump -v app_jffs2-p -c -b -e app2

dpavlin@klin:/tmp/foo-files$ ls -al app2 
-rw-r--r-- 1 dpavlin dpavlin 41167608 Dec  1 21:04 app2

sudo modprobe mtdram total_size=41000 erase_size=256
sudo modprobe mtdblock

dpavlin@klin:/tmp/foo-files$ cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 0280a000 00040000 "mtdram test device"

dpavlin@klin:/tmp/foo-files$ sudo dd if=app2 of=/dev/mtdblock0
80405+1 records in
80405+1 records out
41167608 bytes (41 MB) copied, 0.47149 s, 87.3 MB/s

dpavlin@klin:/tmp/foo-files$ mkdir /tmp/foo-app2

dpavlin@klin:/tmp/foo-files$ sudo mount /dev/mtdblock0 /tmp/foo-app2/ -t jffs2

dpavlin@klin:/tmp/foo-files$ ls -al /tmp/foo-app2/
total 39592
drwxr-xr-x 3 root root        0 Jan  1  1970 .
drwxrwxrwt 1 root root     1726 Dec  1 21:14 ..
-rwx------ 1 root root 40542208 Nov  2  2011 app_sqfs

dpavlin@klin:/tmp/foo-app2$ sudo unsquashfs -l app_sqfs  | less

### ramdisk

dpavlin@klin:/tmp/foo-files/rootfs-ppc$ dd if=../rootfs-p of=rootfs-ppc.gz bs=64 skip=1
59783+1 records in
59783+1 records out
3826120 bytes (3.8 MB) copied, 0.164652 s, 23.2 MB/s
dpavlin@klin:/tmp/foo-files/rootfs-ppc$ file rootfs-ppc.gz 
rootfs-ppc.gz: gzip compressed data, was "ramdisk.img", last modified: Wed Nov  2 20:57:28 2011, max compression, from Unix

dpavlin@klin:/tmp/foo-files/rootfs-ppc$ gzip -d rootfs-ppc.gz 

dpavlin@klin:/tmp/foo-files/rootfs-ppc$ file rootfs-ppc 
rootfs-ppc: Linux rev 0.0 ext2 filesystem data, UUID=00000000-0000-0000-0000-000000000000

dpavlin@klin:/tmp/foo-files/rootfs-ppc$ mkdir rootfs
dpavlin@klin:/tmp/foo-files/rootfs-ppc$ sudo mount rootfs-ppc rootfs/ -o loop

serial port
• http://vogelchr.blogspot.hr/2011/06/promise‑smartstor‑ns4600‑serial‑port.html 

https://plus.google.com/photos/102970072923818524447/albums/5025551365487818161/5614004462366176018?pid=5614004462366176018&oid=102970072923818524447 
On my board (which is marked NS4600P GP0930‑03 REV.A3) serial connector is marked CN6)
pinout:

pin	voltage	serial	
1	3.3V	TX	
2	0V	GND	
3	1.7V	RX	
4	3.3V	VCC	

Serial port output:
U-Boot 1.3.4 (NS4600p - 013 - 800MHz) (Jun 01 2010 - 16:16:09)

CPU:   AMCC PowerPC 431EXr at 800 MHz (PLB=200, OPB=100, EBC=100 MHz)
       Security/Kasumi support
       Bootstrap Option F - Boot ROM Location NAND (8 bits), booting from NAND
       Internal PCI arbiter disabled
       32 kB I-Cache 32 kB D-Cache
Board: NS4600p - PROMISE 4-bay NAS Target Board, 1*PCIe/1*SATA
I2C:   ready
DRAM:  256 MB
Enclosure: Load fan configurations from VPD
NAND:  128 MiB
eth0 MAC = 00:01:55:30:53:89
eth1 MAC = 00:00:00:00:00:00
PCI:   Bus Dev VenId DevId Class Int
PCIE1: successfully set as root-complex
        01  00  105a  3f20  0104  00
SCSI:  Net:   ppc_4xx_eth0

Hit Ctrl + C to stop autoboot:  0 
No wakeup events detected! Auto booting...
Leave clock generator PD mode... OK
Leave net PHY PD mode... OK
Turn on all activity LED power... OK
Blinking LED... OK
Turn on disk power... OK

NAND read: device 0 offset 0xc80000, size 0x300000
 3145728 bytes read: OK

NAND read: device 0 offset 0xf80000, size 0x800000
 8388608 bytes read: OK

NAND read: device 0 offset 0x100000, size 0x3000
 12288 bytes read: OK
## Booting kernel from Legacy Image at 01200000 ...
   Image Name:   Linux-2.6.32.14
   Created:      2011-01-20   4:39:31 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    2339544 Bytes =  2.2 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 01b00000 ...
   Image Name:   02.01.0000.22
   Created:      2011-11-02  20:57:34 UTC
   Image Type:   PowerPC Linux RAMDisk Image (gzip compressed)
   Data Size:    3826120 Bytes =  3.6 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 01a00000
   Booting using the fdt blob at 0x1a00000
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 0fa55000, end 0fdfb1c8 ... OK
   Loading Device Tree to 00ffa000, end 00ffffff ... OK
Using PowerPC 44x Platform machine description
Linux version 2.6.32.14 (root@ptk-229) (gcc version 4.2.2) #3 Thu Jan 20 12:39:14 CST 2011
Found initrd at 0xcfa55000:0xcfdfb1c8
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00001000
  HighMem  0x00001000 -> 0x00001000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00001000
MMU: Allocated 1088 bytes of context maps for 255 contexts
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4094
Kernel command line: root=/dev/ram rw console=ttyS0,115200 mtdparts=nand0:1024K(u-boot),512K(dtb),3072K(safe-k),8192K(safe-r),3072K(kernel),8192K(rootfs),16384K(usr),2048K(data),1024K(oem),87552K(app)
PID hash table entries: 1024 (order: -4, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 1, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 0, 65536 bytes)
Memory: 252096k/262144k available (4864k kernel code, 10048k reserved, 512k data, 269k bss, 384k init)
Kernel virtual memory layout:
  * 0xffef0000..0xffff0000  : fixmap
  * 0xfdee0000..0xffee0000  : highmem PTEs
  * 0xfd6e0000..0xfdee0000  : consistent mem
  * 0xfd6e0000..0xfd6e0000  : early ioremap
  * 0xd1000000..0xfd6e0000  : vmalloc & ioremap
SLUB: Genslabs=15, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:512
UIC0 (32 IRQ sources) at DCR 0xc0
UIC1 (32 IRQ sources) at DCR 0xd0
UIC2 (32 IRQ sources) at DCR 0xe0
UIC3 (32 IRQ sources) at DCR 0xf0
clocksource: timebase mult[500000] shift[22] registered
Console: colour dummy device 80x25
Mount-cache hash table entries: 8192
xor: measuring software checksum speed
   8regs     :    96.000 MB/sec
   8regs_prefetch:   128.000 MB/sec
   32regs    :    96.000 MB/sec
   32regs_prefetch:   112.000 MB/sec
xor: using function: 8regs_prefetch (128.000 MB/sec)
NET: Registered protocol family 16
OCM1: 65536 Bytes (enabled)
OCM1: 65536 Bytes (non-cached)
OCM1: 0 Bytes (cached)
256k L2-cache enabled
PCIE0: Port disabled via device-tree
PCIE1: Checking link...
PCIE1: Device detected, waiting for link...
PCIE1: link is up !
PCI host bridge /plb/pciex@d20000000 (primary) ranges:
 MEM 0x0000000e80000000..0x0000000effffffff -> 0x0000000080000000 
 MEM 0x0000000f00100000..0x0000000f001fffff -> 0x0000000000000000 
  IO 0x0000000f80010000..0x0000000f8001ffff -> 0x0000000000000000
 Removing ISA hole at 0x0000000f00100000
4xx PCI DMA offset set to 0x00000000
/plb/pciex@d20000000: Legacy ISA memory support enabled
PCIE1: successfully set as root-complex
PCI: Probing PCI hardware
PCI: Hiding 4xx host bridge resources 0000:80:00.0
pci 0000:80:00.0: PCI bridge, secondary bus 0000:81
pci 0000:80:00.0:   IO window: 0x1000-0x1fff
pci 0000:80:00.0:   MEM window: 0x80000000-0x800fffff
pci 0000:80:00.0:   PREFETCH window: disabled
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
mod_init:1047
ppc460ex_dma_per_chan_init:1059
Switching to clocksource timebase
NET: Registered protocol family 2
IP route cache hash table entries: 16384 (order: 0, 65536 bytes)
TCP established hash table entries: 8192 (order: 0, 65536 bytes)
TCP bind hash table entries: 8192 (order: -1, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Trying to unpack rootfs image as initramfs...
rootfs image is not initramfs (no cpio magic); looks like an initrd
Freeing initrd memory: 3736k freed
Probing AMCC DMA driver
PPC4xx PLB DMA engine @0x04_00018080 size 200 IRQ 25 
PPC460ex PLB DMA engine @0x00_00000100 size 263
new_chan->chan_id 0x0
new_chan->chan->chan_id 0x0
PPC460ex PLB DMA engine @0x00_00000108 size 271
new_chan->chan_id 0x1
new_chan->chan->chan_id 0x1
PPC460ex PLB DMA engine @0x00_00000110 size 279
new_chan->chan_id 0x2
new_chan->chan->chan_id 0x2
PPC460ex PLB DMA engine @0x00_00000118 size 287
new_chan->chan_id 0x3
new_chan->chan->chan_id 0x3
VFS: Disk quotas dquot_6.5.2
Dquot-cache hash table entries: 16384 (order 0, 65536 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.13)
SGI XFS with ACLs, security attributes, large block/inode numbers, no debug enabled
SGI XFS Quota Management subsystem
msgmni has been set to 496
alg: No test for stdrng (krng)
async_tx: api initialized (async)
io scheduler noop registered
io scheduler deadline registered (default)
ppc4xx_gpio:gpio0_base(0xd13a0b00), gpio1_base(0xd13e0c00)
ppc4xx_gpio:Success to register driver (major = 253)
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550A
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550A
4ef600300.serial: ttyS0 at MMIO 0x4ef600300 (irq = 19) is a 16550
4ef600400.serial: ttyS1 at MMIO 0x4ef600400 (irq = 20) is a 16550
brd: module loaded
loop: module loaded
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
Scanning device for bad blocks

10 cmdlinepart partitions found on MTD device nand0
Creating 10 MTD partitions on "nand0":
0x000000000000-0x000000100000 : "u-boot"
0x000000100000-0x000000180000 : "dtb"
0x000000180000-0x000000480000 : "safe-k"
0x000000480000-0x000000c80000 : "safe-r"
0x000000c80000-0x000000f80000 : "kernel"
0x000000f80000-0x000001780000 : "rootfs"
0x000001780000-0x000002780000 : "usr"
0x000002780000-0x000002980000 : "data"
0x000002980000-0x000002a80000 : "oem"
0x000002a80000-0x000008000000 : "app"
PPC 4xx OCP EMAC driver, version 3.54
mal0: descriptor-memory = ocm
MAL v2 /plb/mcmal, 2 TX channels, 16 RX channels
ZMII /plb/opb/emac-zmii@ef600d00 initialized
RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
TAH /plb/opb/emac-tah@ef601350 initialized
TAH /plb/opb/emac-tah@ef601450 initialized
/plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
eth0: EMAC-0 /plb/opb/ethernet@ef600e00, MAC 00:01:55:30:53:89
eth0: found Generic MII PHY (0x00)
/plb/opb/emac-rgmii@ef601500: input 1 in RGMII mode
/plb/opb/ethernet@ef600f00: can't find PHY!
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ppc-of-ehci 4bffd0400.ehci: OF EHCI
ppc-of-ehci 4bffd0400.ehci: new USB bus registered, assigned bus number 1
ppc-of-ehci 4bffd0400.ehci: irq 36, io mem 0x4bffd0400
ppc-of-ehci 4bffd0400.ehci: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: OF EHCI
usb usb1: Manufacturer: Linux 2.6.32.14 ehci_hcd
usb usb1: SerialNumber: PPC-OF USB
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
ppc-of-ohci 4bffd0000.usb: OF OHCI
ppc-of-ohci 4bffd0000.usb: new USB bus registered, assigned bus number 2
ppc-of-ohci 4bffd0000.usb: irq 37, io mem 0x4bffd0000
usb usb2: New USB device found, idVendor=1d6b, idProduct=0001
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: OF OHCI
usb usb2: Manufacturer: Linux 2.6.32.14 ohci_hcd
usb usb2: SerialNumber: PPC-OF USB
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver usblp
dwc_otg: version 2.60a 22-NOV-2006
dwc_otg: Using Slave mode
dwc_otg dwc_otg.0: DWC OTG Controller
dwc_otg dwc_otg.0: new USB bus registered, assigned bus number 3
dwc_otg dwc_otg.0: irq 28, io mem 0x00000000
dwc_otg: Init: Port Power? op_state=1
dwc_otg: Init: Power Port (0)
usb usb3: New USB device found, idVendor=1d6b, idProduct=0002
usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb3: Product: DWC OTG Controller
usb usb3: Manufacturer: Linux 2.6.32.14 dwc_otg_hcd
usb usb3: SerialNumber: dwc_otg.0
usb usb3: configuration #1 chosen from 1 choice
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
i2c /dev entries driver
ibm-iic 4ef600700.i2c: using standard (100 kHz) mode
rtc-pcf8563 0-0051: chip found, driver version 0.4.3
rtc-pcf8563 0-0051: rtc core: registered rtc-pcf8563 as rtc0
ibm-iic 4ef600800.i2c: using standard (100 kHz) mode
W83L786: Load fan configurations from VPD
PPC4xx WDT : WDT start on boot !! The period is about 30 seconds
<ppc460ex_configure_raid_devices> line 371
<ppc460ex_configure_raid_devices> line 389
<ppc460ex_configure_raid_devices> line 405
 ppc460ex_dma_1_channel.resource[0].start=0x31d6 
<ppc460ex_configure_raid_devices> line 426 dma_reg1=0xd5720200 
<ppc460ex_configure_raid_devices> line 444
--------------- ppc460ex_adma_probe: 4327-------------------------
Improved ADMA - 061508
adev->res[0].start=0x0
 adev->id = 0x1 ppc460ex_dma_1_channel.resource[0].start=0xffffffff 
 descriptor-memory = ocm
<ppc460ex_adma_probe> irq=0x29
<ppc460ex_adma_probe> irq=0x36
--------------- ppc460ex_adma_probe: 4511-------------------------
<ppc460ex_adma_probe> ret=0x0
device-mapper: ioctl: 4.15.0-ioctl (2009-04-01) initialised: dm-devel@redhat.com
usbcore: registered new interface driver hiddev
usbcore: registered new interface driver usbhid
usbhid: v2.6:USB HID core driver
TCP cubic registered
NET: Registered protocol family 17
NET: Registered protocol family 5
rtc-pcf8563 0-0051: setting system clock to 2015-12-01 19:36:42 UTC (1448998602)
RAMDISK: gzip image found at block 0
VFS: Mounted root (ext2 filesystem) on device 1:0.
Freeing unused kernel memory: 384k init
INIT: version 2.86 booting
Mount MNT
Mount Usr
Mount Promise
Mount Data
Mount OEM
Mount nfsd
Enable RAID5
PPC460Ex RAID-5 has been activated successfully
Loading modules: 
t3sas - t3sas 0000:81:00.0: enabling device (0006 -> 0007)
t3sas 0000:81:00.0: Found PDC42819 Controller 105a:3f20 with IRQ: 18
t3sas 0000:81:00.0: Driver version of PDC42819 : 1.3.0.14-NAS-15
scsi0 : t3sas
scsi 0:0:8:0: Processor         Promise  RAID Console     1.00 PQ: 0 ANSI: 3
scsi 0:0:8:0: Attached scsi generic sg0 type 3
usb-storage - Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
sata_dwc - sata-dwc sata-dwc.0: id 0, controller version 1.82
sata-dwc sata-dwc.0: DMA initialized
sata-dwc sata-dwc.0: **** No neg speed (nothing attached?) 
scsi1 : sata-dwc
ata1: SATA max UDMA/133 irq 22
iscsi_trgt - iSCSI Enterprise Target Software - version 1.4.20.2
iscsi_trgt: Registered io type fileio
iscsi_trgt: Registered io type blockio
iscsi_trgt: Registered io type nullio

Copying config files to root fs
cp: `/usr/local/atalk/etc' is not a directory
cp: unable to preserve times of `/usr/local/atalk': Read-only file system
cp: unable to preserve ownership of `/usr/local/atalk': Read-only file system
cp: unable to preserve permissions of `/usr/local/atalk': Read-only file system
cp: `/usr/local/samba/lib' is not a directory
cp: `/usr/local/samba/private' is not a directory
cp: unable to preserve times of `/usr/local/samba': Read-only file system
cp: unable to preserve ownership of `/usr/local/samba': Read-only file system
cp: unable to preserve permissions of `/usr/local/samba': Read-only file system
cp: `/usr/local/proftp/etc' is not a directory
cp: unable to preserve times of `/usr/local/proftp': Read-only file system
cp: unable to preserve ownership of `/usr/local/proftp': Read-only file system
cp: unable to preserve permissions of `/usr/local/proftp': Read-only file system
cp: unable to preserve times of `/usr/local': Read-only file system
cp: unable to preserve ownership of `/usr/local': Read-only file system
cp: unable to preserve permissions of `/usr/local': Read-only file system
cp: `/usr/local/atalk/etc' is not a directory
No vg needs to be restored.
quotacheck: Can't find filesystem to check or filesystem not mounted with quota option.
mount: special device /dev/vg001/lv001 does not exist

Local time (GMT+1): Tue Dec  1 20:37:07 GMT+1 2015

0, 0, 0, 0, 0, 
0, 0
1448998627
7,37,20,1,11,115,2,334,0
INIT: Entering runlevel: 2
Starting syslogd...syslogd: Already running.
klogd: Already running.
Starting base networking daemons: portmap inetd.
Starting periodic command scheduler: cron.
Starting LPD service...
Starting loopback...
Starting network...
eth0: link is down
eth0: link is down
Starting httpd...
Swap Memory On...LED => 1  
Checking File System...0, 0, 0, 0, 0, 
0, 0
1448998670
50,37,20,1,11,115,2,334,0
Starting SMB...sh invoked oom-killer: gfp_mask=0x200da, order=0, oom_adj=0
Call Trace:
[c8735ce0] [c0005968] show_stack+0x50/0x154 (unreliable)
[c8735d20] [c0052860] oom_kill_process+0x54/0x1bc
[c8735d50] [c0052d18] __out_of_memory+0x144/0x160
[c8735d90] [c0052db0] out_of_memory+0x7c/0xa8
[c8735db0] [c00556a4] __alloc_pages_nodemask+0x3e4/0x4b8
[c8735e40] [c0063f8c] do_wp_page+0x3fc/0x78c
[c8735e90] [c0010c18] do_page_fault+0x294/0x41c
[c8735f40] [c000d70c] handle_page_fault+0xc/0x80
Mem-Info:
DMA per-cpu:
CPU    0: hi:    0, btch:   1 usd:   0
active_anon:1572 inactive_anon:1577 isolated_anon:0
 active_file:19 inactive_file:21 isolated_file:0
 unevictable:0 dirty:0 writeback:0 unstable:0
 free:128 slab_reclaimable:22 slab_unreclaimable:145
 mapped:32 shmem:5 pagetables:91 bounce:0
DMA free:8192kB min:8192kB low:10240kB high:12288kB active_anon:100608kB inactive_anon:100928kB active_file:1216kB inactive_file:1344kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:262016kB mlocked:0kB dirty:0kB writeback:0kB mapped:2048kB shmem:320kB slab_reclaimable:1408kB slab_unreclaimable:9280kB kernel_stack:592kB pagetables:5824kB unstable:0kB bounce:0kB writeback_tmp:0kB pages_scanned:32 all_unreclaimable? no
lowmem_reserve[]: 0 0 0 0
DMA: 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB 1*8192kB 0*16384kB 0*32768kB 0*65536kB = 8192kB
45 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap  = 0kB
Total swap = 0kB
4096 pages RAM
0 pages HighMem
180 pages reserved
277 pages shared
3591 pages non-shared
Out of memory: kill process 1934 (smbd) score 186 or a child
Killed process 1934 (smbd)
cron invoked oom-killer: gfp_mask=0x201da, order=0, oom_adj=0
Call Trace:
[c0cffc50] [c0005968] show_stack+0x50/0x154 (unreliable)
[c0cffc90] [c0052860] oom_kill_process+0x54/0x1bc
[c0cffcc0] [c0052d18] __out_of_memory+0x144/0x160
[c0cffd00] [c0052db0] out_of_memory+0x7c/0xa8
[c0cffd20] [c00556a4] __alloc_pages_nodemask+0x3e4/0x4b8
[c0cffdb0] [c00577f0] __do_page_cache_readahead+0xa4/0x1f8
[c0cffe00] [c0051a84] filemap_fault+0x1d8/0x3d8
[c0cffe40] [c0063554] __do_fault+0x5c/0x438
[c0cffe90] [c0010c18] do_page_fault+0x294/0x41c
[c0cfff40] [c000d70c] handle_page_fault+0xc/0x80
Mem-Info:
DMA per-cpu:
CPU    0: hi:    0, btch:   1 usd:   0
active_anon:1578 inactive_anon:1585 isolated_anon:0
 active_file:5 inactive_file:29 isolated_file:0
 unevictable:0 dirty:0 writeback:0 unstable:0
 free:128 slab_reclaimable:20 slab_unreclaimable:145
 mapped:17 shmem:5 pagetables:81 bounce:0
DMA free:8192kB min:8192kB low:10240kB high:12288kB active_anon:100992kB inactive_anon:101440kB active_file:320kB inactive_file:1856kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:262016kB mlocked:0kB dirty:0kB writeback:0kB mapped:1088kB shmem:320kB slab_reclaimable:1280kB slab_unreclaimable:9280kB kernel_stack:568kB pagetables:5184kB unstable:0kB bounce:0kB writeback_tmp:0kB pages_scanned:43 all_unreclaimable? no
lowmem_reserve[]: 0 0 0 0
DMA: 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB 1*8192kB 0*16384kB 0*32768kB 0*65536kB = 8192kB
39 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/0
Free swap  = 0kB
Total swap = 0kB
4096 pages RAM
0 pages HighMem
180 pages reserved
209 pages shared
3609 pages non-shared
Out of memory: kill process 2014 (nmbd) score 184 or a child
Killed process 2014 (nmbd)

Starting FTP...

Starting AFP...
warning: `proftpd' uses 32-bit capabilities (legacy support in use)
Starting quota...
Starting Domain Integrate...
Starting alert agent...
I2 Event Daemon, Ver 1.0.0.0
Checking last shutdown...
Check Data Partition : OK

NS4600 R2.0 A1 (Version 02.01.0000.22) - Promise Technology, INC.
c014-nas login: LED => 1

reset password
Hold button near ethernet connector until long beep is heard to reset password
INShutting down alert agent...killall: alert_agent: no process killed
Stopping periodic command scheduler: cronstopped /usr/sbin/cron (pid 1908).
.
Shutting down syslogd...killall: syslogd: no process killed
killall: klogd: no process killed

Shutting down Bonjour...
Shutting down AppleTalk services: Can't unregister C014-NAS:Workstation@*
Can't unregister C014-NAS:netatalk@*
cat: /var/lock/atalkd: No such file or directory
kill: Could not kill pid '2376': No such process

Shutting down FTP service...
Shutting down NFS...

Shutting down SMB service...Shutting down httpd...
Clear boot flag...
Sending all processes the TERM signal... done.
Sending all processes the KILL signal... done.
eepromctl 7.3, a 24Cxx EEPROM reader/writer
Bus: /dev/i2c0, Address: 0x50, Mode: 8bit
Deactivating swap...done.
Unmounting local filesystems...done.

U-Boot 1.3.4 (NS4600p - 013 - 800MHz) (Jun 01 2010 - 16:16:09)

CPU:   AMCC PowerPC 431EXr at 800 MHz (PLB=200, OPB=100, EBC=100 MHz)
       Security/Kasumi support
       Bootstrap Option F - Boot ROM Location NAND (8 bits), booting from NAND
       Internal PCI arbiter disabled
       32 kB I-Cache 32 kB D-Cache
Board: NS4600p - PROMISE 4-bay NAS Target Board, 1*PCIe/1*SATA
I2C:   ready
DRAM:  256 MB
Enclosure: Load fan configurations from VPD
NAND:  128 MiB
eth0 MAC = 00:01:55:30:53:89
eth1 MAC = 00:00:00:00:00:00
PCI:   Bus Dev VenId DevId Class Int
PCIE1: successfully set as root-complex
        01  00  105a  3f20  0104  00
SCSI:  Net:   ppc_4xx_eth0

Hit Ctrl + C to stop autoboot:  0 
Waiting for PHY auto negotiation to complete...... TIMEOUT !
 done
ENET Speed is 10 Mbps - HALF duplex connection (EMAC0)
Wake on POWER_BUTTON / LAN 
Press Ctrl + C to leave...

u‑boot info
=> bdinfo
memstart    = 0x00000000
memsize     = 0x10000000
flashstart  = 0x00000000
flashsize   = 0x00000000
flashoffset = 0x00000000
sramstart   = 0x00000000
sramsize    = 0x00000000
bootflags   = 0x0108C6F0
intfreq     =    800 MHz
busfreq     =    200 MHz
ethaddr     = 00:01:55:30:53:89
eth1addr    = 00:00:00:00:00:00
IP addr     = 192.168.207.168
baudrate    = 115200 bps

=> iprobe
Valid chip addresses: 2E 50 51 69

u‑boot boot to shell
=> printenv addtty
addtty=setenv bootargs ${bootargs} console=ttyS0,${baudrate}

=> setenv addtty setenv bootargs \${bootargs} console=ttyS0,\${baudrate} init=/bin/sh

=> printenv addtty
addtty=setenv bootargs ${bootargs} console=ttyS0,${baudrate} init=/bin/sh

=> boot
Waiting for PHY auto negotiation to complete...... TIMEOUT !
 done
Wake on POWER_BUTTON / LAN
Press Ctrl + C to leave...

# press power button to start boot

Set autoboot flag
Starting to write EEPROM
OK
Power button was pressed !
Leave clock generator PD mode... OK
Leave net PHY PD mode... OK
Turn on all activity LED power... OK
FAN_SET mode... OK
Blinking LED... OK
Turn on disk power... OK

# etc, etc....

manual boot with root shell
$ cat /etc/init.d/checkroot 
#!/bin/sh

/bin/mount -t proc /proc /proc
echo "Mount MNT"
/bin/mkdir /mnt/usr_fs
/bin/mount -t jffs2 -r /dev/mtdblock6 /mnt/usr_fs
/bin/mkdir /mnt/app_fs
/bin/mount -t jffs2 -r /dev/mtdblock9 /mnt/app_fs
echo "Mount Usr"
/bin/mount -o loop -t squashfs /mnt/usr_fs/usr_sqfs /usr
echo "Mount Promise"
/bin/mount -o loop -t squashfs /mnt/app_fs/app_sqfs /promise
#/bin/mount -t jffs2 /dev/mtdblock9 /promise
echo "Mount Data"
/bin/mount -t jffs2 /dev/mtdblock7 /data
echo "Mount OEM"
/bin/mkdir /mnt/oem
/bin/mount -t jffs2 -r /dev/mtdblock8 /mnt/oem

echo "Enable RAID5"
/sbin/enable_raid5 >/dev/null 2>/dev/null

$ /sbin/enable_raid5

PPC460Ex RAID-5PPC460Ex RAID-5 has been activated successfully
 enable utility.
Current RAID-5 state:
PPC460Ex RAID-r5 capabilities are DISABLED.

Activate RAID-5.
RAID-5 state:
PPC460Ex RAID-r5 capabilities are ENABLED.

$ cat /etc/modules 
# /etc/modules: kernel modules to load at boot time.
t3sas
usb-storage
sata_dwc
iscsi_trgt

$ insmod /lib/modules/t3sas.ko 
t3sas 0000:81:00.0: enabling device (0006 -> 0007)
t3sas 0000:81:00.0: Found PDC42819 Controller 105a:3f20 with IRQ: 18
t3sas 0000:81:00.0: Driver version of PDC42819 : 1.3.0.14-NAS-11

## this takes very long, but eventually....

scsi0 : t3sas
scsi 0:0:0:0: Direct-Access     Promise  3+1 Disk RAID5   1.10 PQ: 0 ANSI: 4
sd 0:0:0:0: [sda] 2929926144 512-byte logical blocks: (1.50 TB/1.36 TiB)
sd 0:0:0:0: Attached scsi generic sg0 type 0
scsi 0:0:8:0: Processor         Promise  RAID Console     1.00 PQ: 0 ANSI: 3
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
scsi 0:0:8:0: Attached scsi generic sg1 type 3
 sda: sda1
sd 0:0:0:0: [sda] Attached SCSI disk

$ mount /sys/

$ /usr/sbin/pvscan 
  PV /dev/sda1   VG vg001   lvm2 [1.36 TB / 488.00 MB free]
  Total: 1 [1.36 TB] / in use: 1 [1.36 TB] / in no VG: 0 [0   ]

$ /usr/sbin/vgchange -a y vg001
  2 logical volume(s) in volume group "vg001" now active

$ /usr/sbin/lvs
  LV     VG    Attr   LSize   Origin Snap%  Move Log Copy%  Convert
  lv001  vg001 -wi-a-   1.36T                                      
  nsswap vg001 -wi-a- 512.00M                                      

$ mkdir /tmp/lv001
$ mount /dev/vg001/lv001 /tmp/lv001/ -o ro
kjournald starting.  Commit interval 5 seconds
EXT3-fs: mounted filesystem with ordered data mode.

$ cat /etc/rc2.d/S60servon